Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite

Unit42 details a long‑running espionage campaign by the Hamas‑affiliated APT 'Ashen Lepus' using a new modular .NET malware suite called AshTag to target government and diplomatic entities across the Middle East; the report describes a multi‑stage infection chain (RAR decoys, side‑loaded loaders and stagers, AshenOrchestrator), in‑memory execution, C2 evasion via legitimate subdomains and embedded HTML payloads, observed hands‑on theft and exfiltration (including use of Rclone), and provides numerous IOCs (SHA256 hashes, AES keys/nonce, C2 domains, and scheduled task names) plus mitigation guidance.